Where your data lives and what leaves your computer
One data file on your machine, a short list of what leaves it, and why logins are never read.
AigoPilot keeps what it knows about your work in one file on your own computer. Your projects and conversations are not uploaded to a server of AigoPilot, and the studio has no cloud copy of them. What does leave your machine is listed below, one line each, with the reason and the moment, so you can decide what you are comfortable with.
This describes how the program is built. It is not the result of an outside security audit.
What stays on your computer
The studio's data is in %APPDATA%\com.aigopilot.studio. The main file there is aigopilot.db: your list of projects, the index of every conversation that the search box uses, usage numbers, settings, alerts, reminders and the carry records. The search is a local index. Nothing in the program is there to count how you use it: the studio contains no analytics or telemetry package.
The conversations themselves are the files that Claude Code, Codex and Grok keep in their own folders. The studio only reads them, and never writes to a file that belongs to one of those tools. The exceptions are the ones you start yourself: a conversation you carry to your own other computer is added to that tool's folder there, without overwriting anything; the entries for news and for the usage percent that the studio writes into Claude Code's settings file, only on your click and after a dated backup copy; and the rules you approve with "also for similar cases", written to the project's local settings.
What leaves your computer
| What | Goes to | When |
|---|---|---|
| Your prompts and the replies | Anthropic, OpenAI or xAI, by the official tool of each, on your own account | Whenever a session runs. It is the same as in a terminal. |
| Calls with a paid API key | Anthropic or OpenAI directly | Only if you added a key under Paid keys. Each call is written in a ledger on your computer. |
| The announcement feed | aigopilot.com | Once, when the studio starts. It only fetches. |
| Newer builds of an agent | aigopilot.com | About once a day, and when you click Check for updates. |
| Notices for a paired iPhone | aigopilot.com, then Apple | Only if you paired a phone. The notice is sealed with a key that only your phone and your studio hold. |
| Telegram notes | Telegram | Only if you connected your own bot. Project, session and what happened. |
| The mail servers you set up | Only if you added a mailbox, over an encrypted line. | |
| Your other computers and phones when away from home | relay.aigopilot.com, locked bytes only | Only for a computer or phone on another network. |
| Marketplace plugins | aigopilot.com for their measuring and paid runs | Only for a plugin you use. |
| Installers of the tools | The maker's own address, or winget | Only on your yes. |
Logins and tokens
The studio never reads, stores or reuses a subscription token or a cookie of Claude Code, Codex or Grok, and never calls a private endpoint of theirs. Sessions run only through the official tool under your account. To know whether you are signed in, the studio asks the tool for its own account status and keeps only the few fields it shows, such as the plan. The files in which a tool keeps its secrets are never opened.
Keys and the one gateway
Paid API keys, mail passwords and the private key of each paired computer are kept in the Windows Credential Manager, or the Mac Keychain, not in the data file. The program reads one at the moment it needs it. A key you type in is shown once and never again.
Every paid call to a model, and the studio's own web fetches, go through one file of the program. A test fails if any other file names an HTTP client or a model's address. Before a paid call, the worst it could cost is set aside against your budget, and the call is not made if the budget does not hold it. An idle studio sends none.
Other computers and phones
A computer or phone that was never paired gets no answer at all, not even one saying that the studio is there. Pairing and the lock that follows are described in Pairing two computers with six digits. The relay cannot read what passes through it; see Reaching your computers from another network. Your plan and billing are handled on aigopilot.com, in Plans and your account. The backup the studio makes before a change to its data file is in Staying awake, starting with Windows, tray and backups.
Small tips
See where paid-key money went
Open Paid keys. A section named Where the money went lists every call made with your keys, by project, by session and by task, and this ledger is kept on your computer.
Questions
Does AigoPilot upload my projects or conversations?
No. They stay on your computer. Your prompts go to Anthropic, OpenAI or xAI through their official tools, exactly as they would in a terminal.
Does the studio read my Claude or Codex login?
No. It never reads, stores or reuses a subscription token or cookie. It asks the tool for its own account status and keeps only the fields it shows.